Which standards require a hr security policy (joiners, movers, leavers)?

ISO/IEC 27001:2022: 6.1, 6.2, 6.5; The NIS2 Directive: Art. 21(2)(i).

What must a hr security policy (joiners, movers, leavers) contain under ISO 27001?

6.1: Background-check candidates and personnel proportional to risk and classification, within the law. 6.2: State the security responsibilities of both the person and the organization in the employment agreement. 6.5: Define and enforce security responsibilities that remain valid after an exit or role change. The ISO 27002 guidance beside 6.1: Requires background verification checks on all candidates for personnel before they join and on an ongoing basis afterwards, within the bounds of applicable laws, regulations and ethics, and proportionate to business requirements, the classification of information to be accessed and the perceived risk.

Who should own the hr security policy (joiners, movers, leavers)?

The clauses imply the head of HR. The register names the role so the line on your list can carry a name.

How often should a hr security policy (joiners, movers, leavers) be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a hr security policy (joiners, movers, leavers)?

Yes: https://compliance.theartofservice.com/policy-templates/human-resources-security-policy

Every policy type · People

HR security policy (joiners, movers, leavers)

Security before, during and at the end of employment: screening, terms, training, discipline, and the return of access and assets on leaving.

How the register reads it

Also called	personnel security, JML, employee lifecycle
Family	People
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected owner	The head of HR.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 or NIS2 is ticked and no line resolves to it.
Template	Human resources security policy.

Which standards require it, and what each expects it to contain

4 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.1 Screening

Background-check candidates and personnel proportional to risk and classification, within the law.

What the ISO 27002 guidance expects the document to say: Requires background verification checks on all candidates for personnel before they join and on an ongoing basis afterwards, within the bounds of applicable laws, regulations and ethics, and proportionate to business requirements, the classification of information to be accessed and the perceived risk.

Evidence an auditor accepts: The screening procedure, showing what checks are performed and how the level is set against the classification of information accessed and the perceived risk; completed screening records for personnel who joined in the period, including contractors and agency staff; evidence of the legal and regulatory limits applied in each jurisdiction, and of candidate consent where required
Common gap: One‑size‑fits‑all screening regardless of risk
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 6.2 Terms and conditions of employment

State the security responsibilities of both the person and the organization in the employment agreement.

What the ISO 27002 guidance expects the document to say: Requires employment contractual agreements to state what the individual and the organisation are each responsible for with respect to information security.

Evidence an auditor accepts: Employment contracts and contractor agreements containing the information security responsibilities of both parties; evidence the clauses cover confidentiality, acceptable use, return of assets and obligations continuing after employment; signed acceptance records for personnel in scope, including those who joined before the current clause set
Common gap: missing security clauses in standard contracts
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 6.5 Responsibilities after termination or change of employment

Define and enforce security responsibilities that remain valid after an exit or role change.

What the ISO 27002 guidance expects the document to say: Requires the security duties and responsibilities that survive the end of employment, or a move to a different role, to be defined, communicated to the people concerned and enforced.

Evidence an auditor accepts: Documented responsibilities that remain in force after employment ends or after a change of role, such as confidentiality and non disclosure; evidence these were communicated to the individual at the point of departure or change, with acknowledgement; the leaver and mover procedure showing the security steps and their completion within a defined timeframe
Common gap: Delayed revocation of privileged accounts
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

The NIS2 Directive

NIS2 Art. 21(2)(i) Human resources security, access control policies and asset management

Three linked disciplines sit in one point because they fail together. Human resources security covers screening proportionate to the role, security terms in employment, and the leaver process. Access control policy covers how identities are created, what rights they carry, how privileged access is granted and reviewed, and how rights change when a person moves internally. Asset management covers knowing what the entity has, who owns it, how it is classified and what happens at disposal. The join between them is where evidence is usually thin: a leaver process that reclaims the laptop but not the cloud account, or an access review run against a directory that does not include the systems that matter. Internal movers are a sharper test than leavers, because accumulated rights are rarely removed.

Evidence an auditor accepts: Screening policy and records proportionate to role sensitivity; joiner, mover and leaver procedure with timed evidence of access removal; access control policy plus periodic access review results, including privileged accounts
Common gap: Leaver process that covers directory accounts but not federated or cloud services
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Disciplinary process · Offboarding and termination procedure